rdj

Obligatory link to the 2010 list of the top 10 risks: http://www.owasp.org/index.php/Top_10_2010-Main

Interesting how many items are still there from 2004 to 2007 to 2010.

I don't think they mean canceled, as in "not cashed or usable". They mean canceled as in "transaction complete, this instrument is no longer valid for further transactions". When you write a check and someone uses it, it gets sent to your bank to be canceled and stored/destroyed.

While both remarks were somewhat snarky, I'd like to hear your evidence that "the American people" are supporting the "billionaire welfare class". It's the first time I've ever heard the table turned like that and would like to learn more.

For those who don't follow NASCAR. There was a wreck that escaped the view of the TV cameras. The only glimpse appeared to show a car hitting a wall at 170+. The engine was ripped from the car and the driver crawls out and lays on the track. This site used math and maps to piece together what may have happened.

Are they all allergic to snakes (or reptiles in general)?

An article about 2 companies arguing who's better. I must have missed the part where they actually debate, or brawl, about the future of IDS. Seems the biggest technical thought put forth was, "your performance sucks". Maybe that means IDS is headed to a future where performance will suck less. Yay.

I've been loosely following your story and this Forbes piece will certainly add to your company history. I'd like to know how this coverage came about, and why you couldn't/didn't use this platform to highlight some of the payment processing problems you were/are having. Maybe spin it to show the high demand, slow supply, etc.

I wonder what long term effects this has on domain names. If people need only to remember how to use iTunes or Chrome to find and use an app, will you really need your app.com domain anymore?

I don't think this is any closer to reality than it was 2 days ago. The setting shown in the screenshots are not in the latest beta build I installed on the 3GS. Other developers confirmed that it's not in their build either. I have yet to hear someone say they have it.

They changed it. The new header is:

X-Facebook: from zuckmail ([MTI3LjAuMC4x])

(127.0.0.1)

So I guess, nothing else to see here. Move along.

It's the user (I tested with 2 friends to verify). Here's a scenario we talked about in my house: Once potential problem: friends-of-friends. A friend-of-friend comments on something your mutual friend put out, you then comment, the first friend (whom you don't know) can use this trick to ballpark your location.

Not speculation. I just tried this with a few folks, and it works as advertised.

I think rockets are cool, and racing is cool, but I don't see this being that much different than pylon racing with faster planes.

Now, the thing that really bugs me about RacketRacers is how they try to compare themselves to NASCAR. I think the reason NASCAR has become popular is because just about everyone has driven a car and can imagine what it would be like to do it on a circle, banging with other cars. Not many people have had the chance to drive a plane, much less a jet or rocket. It's cool, it's novel, but I don't think it will get the following they hope.

As for the last part of the YouTube video where they guy says this could be the first time virtual racers compete with real racers (soon, not here yet), that reporter should probably check out:

http://www.iracing.com/ - real race car drivers are racing normal people almost every day.

http://www.nascar.com/trackpass/about/raceview/?sc_cid=hp53 - NASCAR's RaceView, which is realtime race data visualized in a sim racing type environment.

It seems to me, it's only a matter of time before iracers can compete, in realtime with real racers.

I wish I had something more insightful to say other than "very clever". I do wonder where this car will end up after the shoot. The corporate headquarters? The ad agency lobby? A science museum? Barrett-Jackson?

Why? In a matter of days even the most computer savvy of folks will have put this behind them. McAfee will still be bundled with Localtown-ISP or installed on the new desktops. Mom and pop will see that their "subscription" is about to expire and won't even wonder if this was the program that broke something with svhost.exe.

While you and I may agree that it would be good business for them to go out of their way to fix this and clean up their image, I just don't think it really matters in the long run. I would be surprised if they do anything other than, "Whoops. The next signatures are here".

Just speculating:

I don't think customers buy "better", they buy "solution". They don't care about elegance or how many features you have. Just, "does it solve my problem?". If two things solve the same problem, it may then come down to "how easy" and "how much money".

On a different note: if you have a plan, stick with it (if you think it is the right plan). Your competitors may have just validated the market for you.

Source report: http://www.symantec.com/about/news/release/article.jsp?prid=...

I'm working through an eval of the scanner right now. It looks like some thought has gone into how it finds files and extension. (There's a README-FIRST in the /dictionaries directory that explains this in details). However, I noticed some artifacts in my logs that point to some interesting beta-goodness behavior. For example:

GET /xmlrpc.php?tar.gz.cpp HTTP/1.1

So, it looks like the scanner found the xmlrpc.php but then started getting confused when it came to arguments versus file extensions.

I'm still testing and hopefully will have time to compare it to WebInspect and AppScan for those interested.

This article highlights the iPhone app. Here is a links for the other versions:

http://www.broadband.gov/

(Although I haven't noticed the Android app).

I did test the iPhone app, worked as advertised. Of course this is all just a government wrapper for services like Speedtest.net.

I learned just before leaving the military. A contractor said, "Learn Perl and you'll have no problem finding a job". So, I grabbed the "Learning Perl" book and forced my way through it. I was horrible (a Linux 'man' page wrapper; or basically system()). I do remember the day, while working on a project, that it all "clicked". All the concepts suddenly made sense. I'm good now, but not great. I can solve problems in just about any programming language. This is 10+ years later.

My project: a "Foursquare meets Mafia Wars" game. You claim a real location, name it and defend it. Generate virtual currency over time and spend it on weapons. The code is complete and the family will be running some tests this weekend. Next, we will invite a few friends, get some feedback and figure out the next steps.

Not sure I get it. It seems to me that the headers are always going to be the same when I use your page (maybe an exception would be the referer.)

For technical feedback: you have a bug. The request isn't displaying properly. It showed mine as:

  GET HTTP/1.1
  accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  accept-charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
  accept-encoding: gzip,deflate
  accept-language: en-us,en;q=0.5
  connection: keep-alive
  host: whatheaders.com
  keep-alive: 115
  referer: http://news.ycombinator.com/
  user-agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6 (.NET CLR 3.5.30729)

Notice the "GET HTTP/1.1". It should probably read "GET / HTTP/1.1"

Check http://processing.org .. This globe seems to be one of the first data visualizations used in several projects. Here's a cool one that uses Flickr geotagging info: http://www.flickr.com/photos/revdancatt/3398050524/

I need an option for:

Probably, but the device missed the mark with me. The purchase will be for someone who just needs an ebook (now ibook?) reader, web browser and music player.

The rapid growth in his follower numbers is certainly impressive, but I'm more curious about who he chooses to follow. Looking through the list, it was mostly foundations. What struck me as odd was that he followed Ashton Kutcher and Ashley Tisdale. We all have our reasons for choosing who we want to read/hear, I would love to know why he lent his mindshare to those two.

I'm curious about the video monitoring on the machines that have been tampered with. What do these security cameras normally see? Do the perps block the camera so it can't see them installing their hardware? If so, couldn't some program be written to determine that the image of a person is abnormal (measure the amount of "whitespace"" around a subject) and trigger some sort of real-time alarm?

That seems like a reasonable expectation. I guess I need to look at this article and scanner a little closer before I comment on what this particular tool does (or doesn't).

Scanners cannot look for every possible bug. They can however, look for known bugs. And that's what most attempt to accomplish.

In a nutshell: The scanner looks for known files (thus you see a lot of 404's). If it finds these files, it may try another check (some query string or POST) to determine if it is the vulnerable version. The scanner then tries to inject some javascript for the XSS. If it sees the injected string in the body of the response, it may start modifiying the request until the javascript is actually valid, resulting in an alert window. If it doesn't see a response weith the injected code, the test is complete, move to the next. Finally, the scanner may look for backup files by taking the list of pages from the crawled site and appending things like .bak, .orig, etc.

If you were to take this scanner and run it against a site that returns status code 200 for every request, and echo's back the query string, I suspect you will see a more extensive list of checks that are performed.

Would it be cheaper to buy noise-canceling headphones?

Cool. Another part of my experiment complete with this publication: how to get press without really trying. (but I should probably save that for another post)